Potential corruption of some pricing data in leihs versions between 3.13.0 and 3.29.0

We regret to report that in leihs 3.13.0, released 2014-09-02 12:20:12 CET, a bug was introduced that can under some circumstances lead to truncation of prices entered in the “initial price” field of items. The bug was reported on 2015-06-17 10:25 CEST and fixed roughly 12 hours later with the release of leihs 3.28.1. Version 3.29.0 additionally provides a Rake task to fix corrupted data, see below.

While all versions between 3.13.0 and 3.28.1 are affected, there is a way to recover truncated data in your instance if you have ever upgraded to at least leihs 3.26.2 (released 2015-05-13, 14:12:16 CET). The method is described below and you will be able to recover data up to the moment at which you’ve upgraded to 3.26.2.

Since running any version between 3.13.0 and 3.26.2 could potentially lead to irrecoverable loss of prices in the “initial price” field, we must urge all leihs users to upgrade to 3.26.2 or later, preferably to 3.29.0 or later.

Description of the error

In leihs 3.13.0, internationalized currency formats were introduced. This means that for some fields when editing inventory items, currency values would be shown in the local currency format. When leihs is set to the German (Switzerland) language, for example, that would make “1234.0” display as “1’234.00”. For the English (US) setting it would be “1,234.00” and so on.

Entering any initial data in the normal decimal form “1234.00” works fine. However, when editing an item and saving it again with the string “1’234.00” in the field “initial price”, the value will be truncated to “1.0” instead of saving as “1234.00”.

The reason is that the string “1’234.00” is incorrectly parsed into a number. The system does not know what to do with non-decimal garbage characters like ‘ or , or ` and assumes they are the decimal separator.

Other examples of truncation to give you an idea of what errors to look for in your system:

  • 10’250’000.00 (Swiss locale) would be saved as 10.0.
  • 5,300.00 (English US locale) would be saved as 5.0.

The problem appears not when entering the initial value, but only when editing an item and saving it again. If you use shortcuts like the inventory helper feature, which saves items after every edit, it is however possible to truncate a large number of items in a short amount of time.

Upgrading to an unaffected version

The upgrade process is the same as always.

Recovering truncated data from 3.26.2 or later

We provide a Rake task in leihs 3.29.0 that attempts to roll back all any audited changes to prices that look like they were caused by this bug. The criteria are:

  1. The price used to be higher than 1000.00.
  2. The price was changed to something equal to the original price divided by 1000.

If both criteria are true, the Rake task will use leihs’ auditing feature to set the price to what it had originally been. Since we believe you would hardly ever actually want to divide something’s value by 1000 for legitimate reasons, we think it is safe to run and won’t cause any unwated changes.

To run this Rake task, assuming that you are on your production server in your leihs directory:

RAILS_ENV=production bundle exec rake app:revert_item_prices

Comments are closed.